Does SSO solve security problems?

[Merik Nanish 1184142]

The combination of a central authentication system (in our case called SSO) which uses HTTPS and letting/forcing users change their p[Mod - Happy Thoughts]words frequently and into more secure ones (than the usual 6-digit p[Mod - Happy Thoughts]words), sounds like a step forward in securing VATSIM. However, when you realize that even VATSIM's own forums are not using SSO for logging in, and that you will eventually transmit your CID and p[Mod - Happy Thoughts]word in an unencrypted way every time you log into the network as a controller/pilot, one wonders if SSO and new p[Mod - Happy Thoughts]word policies are really going to help much.

 

Are there any plans to make to modify FSD server and force it to use encryption at least at the time of logging into the network?

 

Also, are there any plans to make this very forum use SSO for signing on? Note that currently, logging into the VATSIM forum happens on a non-secure HTTP form.

[Norman Blackburn]

This forum uses the actual database so SSO isn't required.

[Colin Schoen]

This forum uses the actual database so SSO isn't required.

 

Merik, excuse me if I didn't understand correctly. I think his concern is about the lack of SSL when logging into the forum and the fact that your login data is transmitted via plaintext when connecting to the FSD servers with any pilot or controller client.

Edited August 13, 2014 at 09:03 PM by Guest

[Merik Nanish 1184142]

Colin got it right.

[Norman Blackburn]

I appreciate the lack of SSL (and did not comment on the FSD side of things) however my comment was only in regard to the forum not needing to use SSO.

[Kieran Hardern]

However, when you realize that even VATSIM's own forums are not using SSO for logging in

Also, are there any plans to make this very forum use SSO for signing on? Note that currently, logging into the VATSIM forum happens on a non-secure HTTP form.

 

The SSO is pretty new, you'll see that things are slowly being moved over to it, however we can't do this all instantly. VATSIM is large and lots of things take coordination with people all around the world. In the case of the forum, it is more complicated considering 3rd party plugins like tapatalk use pretty crude methods of integrating. Because of that, you'll find that it's lower on the priority list than the sites where we can integrate without large disruption.

 

So therefore what your saying isn't wrong, however I'd summarise both our posts as saying "we're not quite there yet".